Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 12,666
- Published in 7 days
- 492
- Critical in 30 days
- 117
- Actively exploited
- 67
Latest vulnerabilities
12,666 vulnerabilities- Medium 4.3
CVE-2015-1788 · OpenSSL
The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as…
Published 12 Jun 2015 · NVD - High 7.5
CVE-2014-8176 · OpenSSL
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact…
Published 12 Jun 2015 · NVD - Unrated
WPV-817fb71f530f · WooCommerce
Vulnerability in WooCommerce
Published 10 Jun 2015 · WPVulnerability - Unrated
WPV-70b7611bf0c7 · WooCommerce
Vulnerability in WooCommerce
Published 10 Jun 2015 · Fixed in 2.2.3 · WPVulnerability - Medium 5.0
CVE-2015-4148 · PHP
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Published 9 Jun 2015 · NVD - High 7.5
CVE-2015-4147 · PHP
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
Published 9 Jun 2015 · NVD - High 7.5
CVE-2015-4026 · PHP
The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
Published 9 Jun 2015 · NVD - High 7.5
CVE-2015-4025 · PHP
PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because…
Published 9 Jun 2015 · NVD - Medium 5.0
CVE-2015-4024 · PHP
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
Published 9 Jun 2015 · NVD - High 7.5
CVE-2015-4022 · PHP
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
Published 9 Jun 2015 · NVD - Medium 5.0
CVE-2015-4021 · PHP
The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
Published 9 Jun 2015 · NVD - Medium 6.8
CVE-2015-3330 · PHP
The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."
Published 9 Jun 2015 · NVD - High 7.5
CVE-2015-3329 · PHP
Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.
Published 9 Jun 2015 · NVD - High 7.5
CVE-2015-3307 · PHP
The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
Published 9 Jun 2015 · NVD - Medium 5.8
CVE-2015-2783 · PHP
ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.
Published 9 Jun 2015 · NVD - Medium 5.0
CVE-2014-7810 · Apache Tomcat
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
Published 7 Jun 2015 · NVD - High 7.8
CVE-2014-0230 · Apache Tomcat
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Published 7 Jun 2015 · NVD - Medium 4.3
CVE-2015-3165 · PostgreSQL
Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
Published 28 May 2015 · NVD - Low 3.7
CVE-2015-4000 · OpenSSL, Java
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Published 21 May 2015 · NVD - Low 3.6
CVE-2015-3631 · Docker Engine
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
Published 18 May 2015 · NVD - High 7.2
CVE-2015-3630 · Docker Engine
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Published 18 May 2015 · NVD - High 7.2
CVE-2015-3627 · Docker Engine
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Published 18 May 2015 · NVD - High 10.0
CVE-2015-0278 · Node.js
libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
Published 18 May 2015 · Fixed in 0.10.37 · NVD - Unrated
WPV-fed8e858bf29 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 15 May 2015 · Fixed in 2.3.4 · WPVulnerability - Unrated
WPV-fc8e1afbc29b · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 15 May 2015 · Fixed in 0.9.4.1 · WPVulnerability - Unrated
WPV-e4f87b5e23e2 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 15 May 2015 · Fixed in 2.2.9 · WPVulnerability - Unrated
WPV-cf8ffe159f9a · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.5 · WPVulnerability - Unrated
WPV-bfba9e175276 · All in One SEO
Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Published 15 May 2015 · Fixed in 2.1.6 · WPVulnerability - Unrated
WPV-bb471c36f639 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.5 · WPVulnerability - Unrated
WPV-ba31b7c4ba78 · All in One SEO
Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Published 15 May 2015 · Fixed in 2.1.6 · WPVulnerability - Unrated
WPV-ba2b29b2a445 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.3 · WPVulnerability - Unrated
WPV-aa479f9eee49 · WP Super Cache (WordPress plugin)
Vulnerability in WP Super Cache
Published 15 May 2015 · Fixed in 1.3.1 · WPVulnerability - Unrated
WPV-9ec8d069904d · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.4 · WPVulnerability - Unrated
WPV-9b466df1ce34 · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.3.6 · WPVulnerability - Unrated
WPV-7e928e56b207 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.3 · WPVulnerability - Unrated
WPV-7b8fc9e88eae · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.0.13 · WPVulnerability - Unrated
WPV-509e0e77b8fe · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.7 · WPVulnerability - Unrated
WPV-3d6938b3fa19 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.3 · WPVulnerability - Unrated
WPV-361ffa3ca1a4 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.3.7 · WPVulnerability - Unrated
WPV-1db3331b4461 · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.0.18 · WPVulnerability - Unrated
WPV-0f62f5811d51 · WP Super Cache (WordPress plugin)
Vulnerability in WP Super Cache
Published 15 May 2015 · Fixed in 1.4.3 · WPVulnerability - Unrated
WPV-806319933a60 · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 6 May 2015 · Fixed in 3.5.3 · WPVulnerability - Unrated
WPV-608914b2227f · Twentyfifteen (WordPress theme)
Vulnerability in Twenty Fifteen
Published 6 May 2015 · WPVulnerability - Unrated
WPV-2eb29006bbbd · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 6 May 2015 · Fixed in 3.5.3 · WPVulnerability - Medium 5.0
CVE-2015-3153 · curl
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Published 1 May 2015 · NVD - Medium 6.5
CVE-2015-3458 · Magento / Adobe Commerce
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue…
Published 29 Apr 2015 · NVD - Medium 5.0
CVE-2015-3457 · Magento / Adobe Commerce
Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.
Published 29 Apr 2015 · NVD - Medium 6.5
CVE-2015-1399 · Magento / Adobe Commerce
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since…
Published 29 Apr 2015 · NVD - Medium 6.5
CVE-2015-1398 · Magento / Adobe Commerce
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the…
Published 29 Apr 2015 · NVD - Medium 6.5
CVE-2015-1397 · Magento / Adobe Commerce
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Published 29 Apr 2015 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.